North Korean hackers deploy new RemotePE malware

TLDR

North Koreas Lazarus Group is using a new RemotePE fileless malware to infiltrate banks and crypto firms through highly targeted social engineering.

1. RemotePE is a memory?only remote access tool delivered via fake investment firm contacts and Calendly-style meeting invites, making it very hard to detect.
2. Researchers link RemotePE to recent compromises of a DeFi firm, and estimate DPRK-linked groups stole about $577 million in crypto in two large incidents early 2026.
3. The main risks are trusted channels like Telegram and developer tools; tighter OpSec, wallet segregation, and endpoint monitoring are key defenses to watch for across the industry.

Deep Dive

1. What RemotePE Is And How It Works

Security researchers describe RemotePE as a fileless remote access malware tied to North Koreas Lazarus Group that targets banks and cryptocurrency companies. It was first seen in 2025 and is still active into 2026.

Attackers typically pose as staff from investment or trading firms on Telegram, then send fake meeting invites via lookalike scheduling pages such as Calendly and Picktime. When victims follow the steps, a loader activates a DLL called DPAPILoader, which uses Windows DPAPI to decrypt and fetch a second-stage payload from a command?and?control server and load it directly into memory.

RemotePE makes heavy use of in?memory techniques like Hells Gate and ETW patching to evade antivirus and logging, leaving minimal disk traces and making post?incident forensics difficult, according to analysis summarized in a recent technical write?up.

2. How It Targets Crypto And The Scale Of Damage

RemotePE has been observed in attacks on both banks and crypto companies, including a case where a DeFi firm was compromised using a chain of tools: RemotePE alongside malware families like PondRAT and ThemeForestRAT. All are rated high or very high difficulty to detect and focus on financial targets.

TRM Labs data cited in the same report says North Korea?linked hackers stole about 577 million dollars in digital assets in just two incidents in the first four months of 2026, accounting for roughly 76 percent of global crypto thefts over that period and bringing total DPRK crypto theft since 2017 to around 6 billion dollars.

3. Practical Risks And Defenses To Watch

The key risk vector is not exotic exploits but trust: Telegram chats, LinkedIn outreach, and normal tools such as meeting schedulers or developer packages that become delivery mechanisms. RemotePE fits the same pattern as other recent campaigns that combine social engineering with stealthy malware aimed at people who control wallets, infrastructure, or code.

For individuals and teams in crypto, the defensive focus is shifting toward: strong identity verification for counterparties, strict separation of hot and cold wallets, limited permissions on work machines, and better monitoring for unusual memory or process behavior. On the ecosystem side, expect more emphasis on endpoint detection tuned for fileless attacks, stricter device policies for key employees, and routine credential rotation after suspected exposure.

Conclusion

RemotePE shows how North Korean state?linked hackers are evolving from obvious exploits to low?footprint, social?engineering?driven malware that directly targets the people and tools behind crypto and banking systems. For crypto users and builders, the main implication is that operational security around communication, devices, and key storage now matters as much as protocol design, and the industry will likely keep investing in human and endpoint defenses as these campaigns continue.